separate ca/pva ports for r/w and r/o access?

[Zimoch Dirk via Core-talk <core-talk at aps.anl.gov>]

Hi folks,

Today someone asked me if it is possible to filter write access to records with
a firewall. The idea is to run a read/write server and a read-only server on the
same IOC on two different ports.

I guess the answer is no. At least my attempts to start two CA server on the
same IP address failed. I tried: 
EPICS_CAS_INTF_ADDR_LIST="<my IP> <my IP>:5070"
But it seems ports are ignored in EPICS_CAS_INTF_ADDR_LIST.
Also, I would not know how to make a server readonly. All 

Would this be a "simple" way to handle write access filtering per firewall
rules, opening the r/w port only to selected client IP addresses?

Dirk